Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 08:41
Behavioral task
behavioral1
Sample
bea1819a7ab01312adf264308d5ecabb05d1cbb8c58f6943e78b7a9391c77838N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
bea1819a7ab01312adf264308d5ecabb05d1cbb8c58f6943e78b7a9391c77838N.exe
-
Size
254KB
-
MD5
dc22f86afd3fdd13045f2c4d544f2b10
-
SHA1
85c194451491931e5d1b3b33c0efa7a8280b97a6
-
SHA256
bea1819a7ab01312adf264308d5ecabb05d1cbb8c58f6943e78b7a9391c77838
-
SHA512
c53feb6d8b9b5fc212c5bb52de82ab57523e94fb812092e1a3ffd30b8039bfd41e89658fd920494fa702f1b65a2aaef39674c49616f60f5b302b046f5d4ae0a2
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpolTjZXvEQo9dfBP/l:y4wFHoS3eFaKHpKT9XvEhdfBP/l
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2408-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/540-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1008-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-101-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2688-100-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2688-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1008-90-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2196-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1572-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1648-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1404-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1668-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1668-187-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2208-204-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2060-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/324-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3000-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1416-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/624-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/972-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-441-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1284-492-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2224-505-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1944-530-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/876-560-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2464-581-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-644-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-875-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2684-936-0x00000000002D0000-0x00000000002F7000-memory.dmp family_blackmoon behavioral1/memory/1804-974-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2140-1231-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1432-1250-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1432-1269-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3052-1281-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2180-1424-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1632 hnhhnn.exe 540 vpppv.exe 1872 fffrfrf.exe 2572 ntbntt.exe 2832 bbtbnn.exe 2764 llxrxxl.exe 2644 hbhhnb.exe 2632 9fxrlfl.exe 1008 hhbtnh.exe 2688 nbtbhb.exe 2196 1rflxfr.exe 1572 5hnhnh.exe 2436 jjdpd.exe 1648 thbnnn.exe 1404 btnthh.exe 2672 3rfrfxf.exe 1396 9bbthb.exe 1964 1nbhhh.exe 1668 dpvvj.exe 2244 dpjvd.exe 2208 pdvvv.exe 1284 7dppp.exe 1580 xlxfrrx.exe 2472 vdddj.exe 664 5xlrlxr.exe 1448 xrlfllr.exe 324 tnhtbh.exe 2060 bnhhhb.exe 3000 jdvjd.exe 944 bnnhhh.exe 1416 7vvdd.exe 2408 1lxrxfl.exe 624 tnbhtn.exe 972 7vjdp.exe 2344 vppvj.exe 2716 1lfxfrx.exe 2796 rfxlxxl.exe 2864 bthnbb.exe 2836 pjvpj.exe 2740 jdvdp.exe 2636 rlfrfrx.exe 1492 tnbntb.exe 2784 nhbtnb.exe 2620 5pjvj.exe 2732 ddvvj.exe 1972 lxllrxl.exe 1628 llflrfr.exe 1004 ttbnbh.exe 2952 tntttb.exe 2960 9jvvp.exe 2856 3vpjv.exe 616 fxffllx.exe 1300 ffxlxfr.exe 2924 3hhhht.exe 2932 jdpvd.exe 1356 pdpdv.exe 1724 llrlflr.exe 1728 ffrxffl.exe 1668 tntbbb.exe 2068 ppjpj.exe 2072 9jvpd.exe 1284 xrlfrxx.exe 884 7llxrrx.exe 2224 tnthnn.exe -
resource yara_rule behavioral1/memory/2408-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2408-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012118-5.dat upx behavioral1/memory/1632-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/540-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015db6-19.dat upx behavioral1/memory/1632-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015dc0-28.dat upx behavioral1/files/0x0008000000015e64-35.dat upx behavioral1/files/0x0007000000015ed2-43.dat upx behavioral1/memory/2832-47-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0007000000015f96-54.dat upx behavioral1/memory/2832-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016009-62.dat upx behavioral1/memory/2764-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001613e-73.dat upx behavioral1/memory/2632-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2644-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1008-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016334-82.dat upx behavioral1/memory/2632-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dd0-99.dat upx behavioral1/memory/2688-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016db5-92.dat upx behavioral1/files/0x0006000000016de4-114.dat upx behavioral1/memory/1572-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2196-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016de8-122.dat upx behavioral1/memory/1572-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016eb8-130.dat upx behavioral1/memory/1648-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2436-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1648-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016edb-140.dat upx behavioral1/files/0x000600000001707c-149.dat upx behavioral1/memory/2672-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1404-148-0x0000000000430000-0x0000000000457000-memory.dmp upx behavioral1/memory/1404-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017400-169.dat upx behavioral1/memory/1964-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017403-178.dat upx behavioral1/memory/1668-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173f3-162.dat upx behavioral1/memory/2672-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001746a-190.dat upx behavioral1/memory/2244-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017488-198.dat upx behavioral1/files/0x0009000000015d96-215.dat upx behavioral1/files/0x00060000000174a6-208.dat upx behavioral1/memory/1580-223-0x00000000003C0000-0x00000000003E7000-memory.dmp upx behavioral1/files/0x00060000000174c3-226.dat upx behavioral1/memory/2472-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001757f-234.dat upx behavioral1/files/0x0015000000018676-242.dat upx behavioral1/files/0x0005000000018696-249.dat upx behavioral1/memory/2060-260-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000187a2-267.dat upx behavioral1/files/0x0005000000018697-259.dat upx behavioral1/memory/324-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018c44-284.dat upx behavioral1/files/0x0006000000018c34-277.dat upx behavioral1/memory/3000-275-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1416-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018f65-293.dat upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2408 wrote to memory of 1632 2408 bea1819a7ab01312adf264308d5ecabb05d1cbb8c58f6943e78b7a9391c77838N.exe 30 PID 2408 wrote to memory of 1632 2408 bea1819a7ab01312adf264308d5ecabb05d1cbb8c58f6943e78b7a9391c77838N.exe 30 PID 2408 wrote to memory of 1632 2408 bea1819a7ab01312adf264308d5ecabb05d1cbb8c58f6943e78b7a9391c77838N.exe 30 PID 2408 wrote to memory of 1632 2408 bea1819a7ab01312adf264308d5ecabb05d1cbb8c58f6943e78b7a9391c77838N.exe 30 PID 1632 wrote to memory of 540 1632 hnhhnn.exe 31 PID 1632 wrote to memory of 540 1632 hnhhnn.exe 31 PID 1632 wrote to memory of 540 1632 hnhhnn.exe 31 PID 1632 wrote to memory of 540 1632 hnhhnn.exe 31 PID 540 wrote to memory of 1872 540 vpppv.exe 32 PID 540 wrote to memory of 1872 540 vpppv.exe 32 PID 540 wrote to memory of 1872 540 vpppv.exe 32 PID 540 wrote to memory of 1872 540 vpppv.exe 32 PID 1872 wrote to memory of 2572 1872 fffrfrf.exe 33 PID 1872 wrote to memory of 2572 1872 fffrfrf.exe 33 PID 1872 wrote to memory of 2572 1872 fffrfrf.exe 33 PID 1872 wrote to memory of 2572 1872 fffrfrf.exe 33 PID 2572 wrote to memory of 2832 2572 ntbntt.exe 34 PID 2572 wrote to memory of 2832 2572 ntbntt.exe 34 PID 2572 wrote to memory of 2832 2572 ntbntt.exe 34 PID 2572 wrote to memory of 2832 2572 ntbntt.exe 34 PID 2832 wrote to memory of 2764 2832 bbtbnn.exe 35 PID 2832 wrote to memory of 2764 2832 bbtbnn.exe 35 PID 2832 wrote to memory of 2764 2832 bbtbnn.exe 35 PID 2832 wrote to memory of 2764 2832 bbtbnn.exe 35 PID 2764 wrote to memory of 2644 2764 llxrxxl.exe 36 PID 2764 wrote to memory of 2644 2764 llxrxxl.exe 36 PID 2764 wrote to memory of 2644 2764 llxrxxl.exe 36 PID 2764 wrote to memory of 2644 2764 llxrxxl.exe 36 PID 2644 wrote to memory of 2632 2644 hbhhnb.exe 37 PID 2644 wrote to memory of 2632 2644 hbhhnb.exe 37 PID 2644 wrote to memory of 2632 2644 hbhhnb.exe 37 PID 2644 wrote to memory of 2632 2644 hbhhnb.exe 37 PID 2632 wrote to memory of 1008 2632 9fxrlfl.exe 38 PID 2632 wrote to memory of 1008 2632 9fxrlfl.exe 38 PID 2632 wrote to memory of 1008 2632 9fxrlfl.exe 38 PID 2632 wrote to memory of 1008 2632 9fxrlfl.exe 38 PID 1008 wrote to memory of 2688 1008 hhbtnh.exe 39 PID 1008 wrote to memory of 2688 1008 hhbtnh.exe 39 PID 1008 wrote to memory of 2688 1008 hhbtnh.exe 39 PID 1008 wrote to memory of 2688 1008 hhbtnh.exe 39 PID 2688 wrote to memory of 2196 2688 nbtbhb.exe 40 PID 2688 wrote to memory of 2196 2688 nbtbhb.exe 40 PID 2688 wrote to memory of 2196 2688 nbtbhb.exe 40 PID 2688 wrote to memory of 2196 2688 nbtbhb.exe 40 PID 2196 wrote to memory of 1572 2196 1rflxfr.exe 41 PID 2196 wrote to memory of 1572 2196 1rflxfr.exe 41 PID 2196 wrote to memory of 1572 2196 1rflxfr.exe 41 PID 2196 wrote to memory of 1572 2196 1rflxfr.exe 41 PID 1572 wrote to memory of 2436 1572 5hnhnh.exe 42 PID 1572 wrote to memory of 2436 1572 5hnhnh.exe 42 PID 1572 wrote to memory of 2436 1572 5hnhnh.exe 42 PID 1572 wrote to memory of 2436 1572 5hnhnh.exe 42 PID 2436 wrote to memory of 1648 2436 jjdpd.exe 43 PID 2436 wrote to memory of 1648 2436 jjdpd.exe 43 PID 2436 wrote to memory of 1648 2436 jjdpd.exe 43 PID 2436 wrote to memory of 1648 2436 jjdpd.exe 43 PID 1648 wrote to memory of 1404 1648 thbnnn.exe 44 PID 1648 wrote to memory of 1404 1648 thbnnn.exe 44 PID 1648 wrote to memory of 1404 1648 thbnnn.exe 44 PID 1648 wrote to memory of 1404 1648 thbnnn.exe 44 PID 1404 wrote to memory of 2672 1404 btnthh.exe 45 PID 1404 wrote to memory of 2672 1404 btnthh.exe 45 PID 1404 wrote to memory of 2672 1404 btnthh.exe 45 PID 1404 wrote to memory of 2672 1404 btnthh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bea1819a7ab01312adf264308d5ecabb05d1cbb8c58f6943e78b7a9391c77838N.exe"C:\Users\Admin\AppData\Local\Temp\bea1819a7ab01312adf264308d5ecabb05d1cbb8c58f6943e78b7a9391c77838N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\hnhhnn.exec:\hnhhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\vpppv.exec:\vpppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\fffrfrf.exec:\fffrfrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\ntbntt.exec:\ntbntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\bbtbnn.exec:\bbtbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\llxrxxl.exec:\llxrxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\hbhhnb.exec:\hbhhnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\9fxrlfl.exec:\9fxrlfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\hhbtnh.exec:\hhbtnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\nbtbhb.exec:\nbtbhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\1rflxfr.exec:\1rflxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\5hnhnh.exec:\5hnhnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\jjdpd.exec:\jjdpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\thbnnn.exec:\thbnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\btnthh.exec:\btnthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\3rfrfxf.exec:\3rfrfxf.exe17⤵
- Executes dropped EXE
PID:2672 -
\??\c:\9bbthb.exec:\9bbthb.exe18⤵
- Executes dropped EXE
PID:1396 -
\??\c:\1nbhhh.exec:\1nbhhh.exe19⤵
- Executes dropped EXE
PID:1964 -
\??\c:\dpvvj.exec:\dpvvj.exe20⤵
- Executes dropped EXE
PID:1668 -
\??\c:\dpjvd.exec:\dpjvd.exe21⤵
- Executes dropped EXE
PID:2244 -
\??\c:\pdvvv.exec:\pdvvv.exe22⤵
- Executes dropped EXE
PID:2208 -
\??\c:\7dppp.exec:\7dppp.exe23⤵
- Executes dropped EXE
PID:1284 -
\??\c:\xlxfrrx.exec:\xlxfrrx.exe24⤵
- Executes dropped EXE
PID:1580 -
\??\c:\vdddj.exec:\vdddj.exe25⤵
- Executes dropped EXE
PID:2472 -
\??\c:\5xlrlxr.exec:\5xlrlxr.exe26⤵
- Executes dropped EXE
PID:664 -
\??\c:\xrlfllr.exec:\xrlfllr.exe27⤵
- Executes dropped EXE
PID:1448 -
\??\c:\tnhtbh.exec:\tnhtbh.exe28⤵
- Executes dropped EXE
PID:324 -
\??\c:\bnhhhb.exec:\bnhhhb.exe29⤵
- Executes dropped EXE
PID:2060 -
\??\c:\jdvjd.exec:\jdvjd.exe30⤵
- Executes dropped EXE
PID:3000 -
\??\c:\bnnhhh.exec:\bnnhhh.exe31⤵
- Executes dropped EXE
PID:944 -
\??\c:\7vvdd.exec:\7vvdd.exe32⤵
- Executes dropped EXE
PID:1416 -
\??\c:\1lxrxfl.exec:\1lxrxfl.exe33⤵
- Executes dropped EXE
PID:2408 -
\??\c:\tnbhtn.exec:\tnbhtn.exe34⤵
- Executes dropped EXE
PID:624 -
\??\c:\7vjdp.exec:\7vjdp.exe35⤵
- Executes dropped EXE
PID:972 -
\??\c:\vppvj.exec:\vppvj.exe36⤵
- Executes dropped EXE
PID:2344 -
\??\c:\1lfxfrx.exec:\1lfxfrx.exe37⤵
- Executes dropped EXE
PID:2716 -
\??\c:\rfxlxxl.exec:\rfxlxxl.exe38⤵
- Executes dropped EXE
PID:2796 -
\??\c:\bthnbb.exec:\bthnbb.exe39⤵
- Executes dropped EXE
PID:2864 -
\??\c:\pjvpj.exec:\pjvpj.exe40⤵
- Executes dropped EXE
PID:2836 -
\??\c:\jdvdp.exec:\jdvdp.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\rlfrfrx.exec:\rlfrfrx.exe42⤵
- Executes dropped EXE
PID:2636 -
\??\c:\tnbntb.exec:\tnbntb.exe43⤵
- Executes dropped EXE
PID:1492 -
\??\c:\nhbtnb.exec:\nhbtnb.exe44⤵
- Executes dropped EXE
PID:2784 -
\??\c:\5pjvj.exec:\5pjvj.exe45⤵
- Executes dropped EXE
PID:2620 -
\??\c:\ddvvj.exec:\ddvvj.exe46⤵
- Executes dropped EXE
PID:2732 -
\??\c:\lxllrxl.exec:\lxllrxl.exe47⤵
- Executes dropped EXE
PID:1972 -
\??\c:\llflrfr.exec:\llflrfr.exe48⤵
- Executes dropped EXE
PID:1628 -
\??\c:\ttbnbh.exec:\ttbnbh.exe49⤵
- Executes dropped EXE
PID:1004 -
\??\c:\tntttb.exec:\tntttb.exe50⤵
- Executes dropped EXE
PID:2952 -
\??\c:\9jvvp.exec:\9jvvp.exe51⤵
- Executes dropped EXE
PID:2960 -
\??\c:\3vpjv.exec:\3vpjv.exe52⤵
- Executes dropped EXE
PID:2856 -
\??\c:\fxffllx.exec:\fxffllx.exe53⤵
- Executes dropped EXE
PID:616 -
\??\c:\ffxlxfr.exec:\ffxlxfr.exe54⤵
- Executes dropped EXE
PID:1300 -
\??\c:\3hhhht.exec:\3hhhht.exe55⤵
- Executes dropped EXE
PID:2924 -
\??\c:\jdpvd.exec:\jdpvd.exe56⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pdpdv.exec:\pdpdv.exe57⤵
- Executes dropped EXE
PID:1356 -
\??\c:\llrlflr.exec:\llrlflr.exe58⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ffrxffl.exec:\ffrxffl.exe59⤵
- Executes dropped EXE
PID:1728 -
\??\c:\tntbbb.exec:\tntbbb.exe60⤵
- Executes dropped EXE
PID:1668 -
\??\c:\ppjpj.exec:\ppjpj.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2068 -
\??\c:\9jvpd.exec:\9jvpd.exe62⤵
- Executes dropped EXE
PID:2072 -
\??\c:\xrlfrxx.exec:\xrlfrxx.exe63⤵
- Executes dropped EXE
PID:1284 -
\??\c:\7llxrrx.exec:\7llxrrx.exe64⤵
- Executes dropped EXE
PID:884 -
\??\c:\tnthnn.exec:\tnthnn.exe65⤵
- Executes dropped EXE
PID:2224 -
\??\c:\thtbtt.exec:\thtbtt.exe66⤵PID:1944
-
\??\c:\7vvpd.exec:\7vvpd.exe67⤵PID:1996
-
\??\c:\3ffrffr.exec:\3ffrffr.exe68⤵PID:564
-
\??\c:\frffxrf.exec:\frffxrf.exe69⤵PID:1736
-
\??\c:\htbbhb.exec:\htbbhb.exe70⤵PID:2060
-
\??\c:\pdpvj.exec:\pdpvj.exe71⤵PID:1240
-
\??\c:\dvjpp.exec:\dvjpp.exe72⤵PID:2988
-
\??\c:\3lfflrr.exec:\3lfflrr.exe73⤵PID:1552
-
\??\c:\1xrrrlr.exec:\1xrrrlr.exe74⤵PID:876
-
\??\c:\7bbthn.exec:\7bbthn.exe75⤵PID:1412
-
\??\c:\nbbnhn.exec:\nbbnhn.exe76⤵PID:1888
-
\??\c:\dvjpv.exec:\dvjpv.exe77⤵PID:2464
-
\??\c:\7lffflf.exec:\7lffflf.exe78⤵PID:2452
-
\??\c:\frlxxxf.exec:\frlxxxf.exe79⤵PID:1512
-
\??\c:\btntht.exec:\btntht.exe80⤵PID:2388
-
\??\c:\9httbb.exec:\9httbb.exe81⤵PID:264
-
\??\c:\pjvjj.exec:\pjvjj.exe82⤵PID:2892
-
\??\c:\9jvjj.exec:\9jvjj.exe83⤵PID:2744
-
\??\c:\rfllrlr.exec:\rfllrlr.exe84⤵PID:2768
-
\??\c:\tnbhth.exec:\tnbhth.exe85⤵PID:2740
-
\??\c:\3ttntt.exec:\3ttntt.exe86⤵PID:2644
-
\??\c:\jdvvd.exec:\jdvvd.exe87⤵PID:2828
-
\??\c:\1ppjv.exec:\1ppjv.exe88⤵PID:2604
-
\??\c:\7lfrrrx.exec:\7lfrrrx.exe89⤵PID:2880
-
\??\c:\1lfxrrf.exec:\1lfxrrf.exe90⤵PID:2120
-
\??\c:\nhbnth.exec:\nhbnth.exe91⤵PID:2176
-
\??\c:\ddvjv.exec:\ddvjv.exe92⤵
- System Location Discovery: System Language Discovery
PID:2296 -
\??\c:\ddvvv.exec:\ddvvv.exe93⤵PID:820
-
\??\c:\5frxflr.exec:\5frxflr.exe94⤵PID:2700
-
\??\c:\ffffxxr.exec:\ffffxxr.exe95⤵PID:1704
-
\??\c:\hbnnth.exec:\hbnnth.exe96⤵PID:2912
-
\??\c:\bnhbhn.exec:\bnhbhn.exe97⤵PID:2432
-
\??\c:\vjdvd.exec:\vjdvd.exe98⤵PID:1308
-
\??\c:\1vdpv.exec:\1vdpv.exe99⤵PID:2916
-
\??\c:\1xlrxxx.exec:\1xlrxxx.exe100⤵PID:2964
-
\??\c:\frxflxf.exec:\frxflxf.exe101⤵PID:1868
-
\??\c:\bthtth.exec:\bthtth.exe102⤵PID:2112
-
\??\c:\7pddd.exec:\7pddd.exe103⤵PID:316
-
\??\c:\3jpvj.exec:\3jpvj.exe104⤵PID:1068
-
\??\c:\9lfrxfr.exec:\9lfrxfr.exe105⤵PID:2400
-
\??\c:\xlflrrx.exec:\xlflrrx.exe106⤵PID:1624
-
\??\c:\5thbht.exec:\5thbht.exe107⤵PID:2444
-
\??\c:\tthhtt.exec:\tthhtt.exe108⤵PID:3024
-
\??\c:\vvppd.exec:\vvppd.exe109⤵PID:740
-
\??\c:\7xxllrf.exec:\7xxllrf.exe110⤵PID:1524
-
\??\c:\fxllxxf.exec:\fxllxxf.exe111⤵PID:3004
-
\??\c:\7nbnhn.exec:\7nbnhn.exe112⤵PID:1996
-
\??\c:\nhhnbh.exec:\nhhnbh.exe113⤵PID:736
-
\??\c:\vpjjd.exec:\vpjjd.exe114⤵PID:1736
-
\??\c:\xrlxxfl.exec:\xrlxxfl.exe115⤵PID:2004
-
\??\c:\rlflllr.exec:\rlflllr.exe116⤵PID:2324
-
\??\c:\9bnhnn.exec:\9bnhnn.exe117⤵PID:2988
-
\??\c:\jdppv.exec:\jdppv.exe118⤵PID:1552
-
\??\c:\jdvvd.exec:\jdvvd.exe119⤵PID:1712
-
\??\c:\rlllrrx.exec:\rlllrrx.exe120⤵PID:2404
-
\??\c:\1xxrxlr.exec:\1xxrxlr.exe121⤵PID:2420
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-